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REMARKS 

Applicants respectfully request favorable reconsideration of this application, as 
amended. 

Claims 10 and 17 were rejected under 35 U.S.C. § 112, first paragraph, while Claims 
8-13, 15 and 17-20 were rejected under 35 U.S.C. § 112, second paragraph. Claims 8, 9, 
14-16 and 21 were rejected under 35 U.S.C. § 103(a) as being unpatentable over Smaha 
(USP 5,557,742) in view of Thuraisingham (USP 5,694,590) and in further view of Schoning 
C'Logic for Computer Scientists")- Claims 10-13 and 17-20 were rejected under 35 U.S.C. § 
103(a) as being unpatentable over Smaha in view of Thuraisingham and Schoning and in 
further view of Cormen flntroduction to Algorithms")- Claims 8-13, 15 and 17-20 have 
been amended to overcome the § 112 rejections. Without acceding to the rejections under 
35 U.S.C. § 103, Claims 8, 10, 15 and 17 have been amended to clarify certain features of 
the claimed invention. Claim 22 has been added to incorporate subject matter deleted from 
Claim 15. 

Applicants submit that the rejections under 35 U.S.C. § 103 are inappropriate, at 
least insofar as those rejections are considered vis-a-vis the claims as now presented. 

Claim 8 is directed to a method for detecting attacks against computer systems and 
recites, inter alia, expanding specification formulas into subformulas for each record of a log 
file, generating, for each expanded formula, Horn clauses expressing implications resolvent 
of the subformulas in positive clauses having a positive literal and in negative clauses having 
at least one negative literal, storing the positive clauses in a stack of subformulas, storing, in 
a table of clauses, a representation of the negative clauses and the positive clauses, storing, 
in a table of counters, a number of negative literals in each negative clause, and resolving 
the table of clauses based on each positive clause so as to generate either an output file or 
an action. Claim 15 is directed to a computer system and recites similar subject matter. 
Applicants respectfully submit that none of the cited references, taken either singly or in 
combination, teach or suggest the features recited by Claims 8 and 15. 

Smaha is directed to a method for detecting intrusion into a data processing system. 
While Smaha discloses system log file data 16 and a list of selected misuses, Smaha is 
entirely silent on whether specification formulas may be expanded into subformulas for each 
record of a log file, whether Horn clauses, having positive and negative clauses, may be 
generated for each expanded formula, whether a stack of subformulas, a table of clauses 
and a table of counters may be stored, and whether the table of clauses may be resolved. 
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based on each positive clause, so as to generate either an output file or an action, as recited 
by Claims 8 and 15. The Examiner apparently agrees. See, Office Action at Page 6, 
Paragraph 20. 

Thuraisingham is directed to a secure database management system and discloses "a 
method based on specifying security constraints as horn clauses" (Col. 2, lines 51-53). 
Thuraisingham fails to teach or suggest whether specification formulas may be expanded 
into subformulas for each record of a log file, as recited by Claims 8 and 15. Furthermore, 
Thuraisingham is entirely silent on whether Horn clauses, having positive and negative 
clauses, may be generated for each expanded formula, whether a stack of subformulas, a 
table of clauses and a table of counters may be stored, and whether the table of clauses 
may be resolved, based on each positive clause, so as to generate either an output file or an 
action, as recited by Claims 8 and 15. The Examiner apparently agrees. See, Office Action 
at Page 6, Paragraph 20. 

Schoning discusses formal logic from a computer science perspective, including 
prepositional logic, predicate logic, and foundations of logic programming. See, e.g., 
Schoning at Pages 3-40, 41-108 and 109-154, respectively. While the Examiner opines 
that Schoning discloses "expanding the formulas into subformulas" (Office Action at Page 7, 
Paragraph 20, item b). Applicants submit that Schoning fails to teach or suggest expanding 
specification formulas into subformulas for each record of a log file, as well as generating 
Horn clauses for each expanded formula, as recited by Claims 8 and 15. Furthermore, 
Schoning is entirely silent on whether a stack of subformulas, a table of clauses and a table 
of counters may be stored, and whether the table of clauses may be resolved, based on 
each positive clause, so as to generate either an output file or an action, as recited by 
Claims 8 and 15. Schoning's "algorithm to decide satsifiability," mentioned on page 35, fails 
to teach or suggest the features recited by Claims 8 and 15. 

Moreover, none of the remaining references, taken either singly or in combination, 
teaches or suggests the features recited by Claims 8 and 15. 

Accordingly, the rejections of Claims 8 and 15 are untenable and should be 
withdrawn. Claims 9-14 and 16-22 should be allowed at least in view of the allowability of 
Claims 8 and 15. 

In view of the amendments presented herein, and the reasons explained in the 
preceding remarks. Applicants submit that this application is in condition for allowance and 
should now be passed to issue. 
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A Notice of Allowance is respectfully solicited. 

If any extension of time is required in connection with the filing of this paper and has 
not been requested separately, such extension is hereby requested. 

The Commissioner is hereby authorized to charge any fees and to credit any 
overpayments that may be required by this paper under 37 C.F.R. §§ 1.16 and 1.17 to 
Deposit Account No. 50-1165. 


Respectfully submitted, 


Miles & Stockbridge P.C. 


September 3, 2004 


Miles & Stockbridge P.C. 
1751 Pinnacle Drive, Suite 500 
McLean, Virginia 22102 
(703) 903-9000 
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